DATA PROTECTION & PRIVACY STATEMENT

WHO WE ARE:

Acorn Property Management Ltd.

WHAT WE DO

We have been appointed by the party within your lease who is responsible for appointing a managing agent to manage the common areas of your development.

WHAT IS OUR ROLE UNDER THE GENERAL DATA PROTECTION REGULATION (GDPR)?

We consider ourselves to be the Data Processor and Controller acting on behalf of the party within your lease who is responsible for appointing a managing agent.

Both the Data Controller and the Data Processor are subject to the Office of Information Commissioner, the Supervisor Authority.

• ICO (Information Commissioners Office), Wycliffe House, Water Lane, Wilmslow, Cheshire, Sk9 5AF

• Tel : 0303 123 1113 | [email protected] | www.ico.org.uk

WHERE DID WE GET YOUR DATA?

Originally your data was received from your solicitor on purchase or received from the previous managing agent when we took over management of your estate/block. Subsequently any data received by us was through the Data Controller or directly from you or another Data Processor for the purposes described below. When you bought your property we contacted you to ask for contact information and we retained the details provided on a database. We update whatever new information is provided to us.

WHAT IS THE PURPOSE OF PROCESSING YOUR DATA?

Your property is subject to a lease to which you, the Data Subject and the party within your lease responsible for placing management are party to. We have been appointed by the party within your lease responsible for placing management to administer the covenants of that lease. We use your personal information to provide you with our property management services for the performance of our contract as Managing Agent (the lawful basis on which we collect and use your personal data).

WHAT IS THE PURPOSE OF PROCESSING YOUR DATA?

Your property is subject to a lease to which you, the Data Subject and the party within your lease responsible for placing management are party to. We have been appointed by the party within your lease responsible for placing management to administer the covenants of that lease. We use your personal information to provide you with our property management services for the performance of our contract as Managing Agent (the lawful basis on which we collect and use your personal data).Examples of this are:

• Contacting you about property management issues involving your Block / Estate.

• To answer your questions about management issues.

• To send you newsletters or to communicate information.

• To organise sub-contractors to repair or inspect your property in relation to our property management services.

• We do not share your data with any unconnected third parties for marketing or any other purposes.

• We do not keep records of tracking cookies on our websiteWe use or share your personal information when there is a lawful or legitimate interest to do so. Data sharing enables us to perform our contract as Managing Agent. We will share personal information with law enforcement or other authorities if required by applicable law.

Examples of this are:

• For an approved contractor to make or confirm an appointment with you regarding a repair or maintenance matter.

• Processing payment for service charges, ground rents or other services.

• Instructing debt collectors or solicitors where needed.

• To enable the handover process we must share information with other Managing Agents or similar.

• Protecting against or to identify possible fraudulent transactions.

• To enforce our Terms and Conditions and otherwise manage our business in accordance with our Management Agreement.We engage third party service providers to perform a variety of business operations on our behalf andin so doing, we may share your personal information with them. Examples of these are:

• To host our website and deliver our email or other communications.

• To store and manage our data.

WHAT IS THE LAWFUL BASIS FOR THIS PROCESSING?

• Processing is necessary for the performance of a contract to which the Data Subject is party (Article 6 GDPR (1)b).

• Processing is necessary for compliance with a legal obligation to which the Data Controller is subject (Article 6 GDPR(1)c). In this instance the party within your lease responsible for placing management is required by the Companies Act 2006 to maintain adequate accounting recordsand a list of members past and present.

• Failure to comply would be a breach of covenant under the terms of the lease which may result in legal action.

WHERE IS THIS DATA STORED?

This data is stored in a company database which is on private password protected business computers. We maintain a schedule of flat owners’ correspondence addresses in Microsoft Word for the purpose of printing address labels and communication. All paper work based data is stored in filing cabinets in our secure offices. Data stored and transferred is encrypted and/or password protected. Access is only granted to administrators associated with our office Data is also stored in a cloud-based location provided by Microsoft OneDrive, is password protected and is GDPR compliant through Microsoft’s own GDPR Compliance. Mobile containing client’s data are protected by a pin or patterned security along with anti virus and anti theft software apps.

WHO IS THE DATA SHARED WITH?

This data is shared only with similar Data Processors for the purpose described above. These Data Processors are:

• Microsoft cloud-based storage. (OneDrive)

• Leaseholders names may be evident when we send service charge documentation to accountants at the end of each financial year.

• Contractors who attend to undertake work. We will always check with you before we give out your contact information to facilitate this work.

• We will never sell your personal information to marketers or companies outside of Acorn Property Management or Associated Companies. We will only ever share your personal information for the legitimate or lawful reasons as described in this Statement.

• Where we share your information as described in this Statement, we will only share the personal information required to perform the services we request, and we contractually require that the service provider protects this information appropriately and not use it for any other purpose.

• If at any point Acorn was to no longer provide Property Management Services and a new agent was appointed on your behalf, they would be expected to adhere to this policy and/or update you with any changes that may be required.

HOW LONG WILL THE DATA BE STORED?

Your data will be maintained by us for as long as our appointment exists or for as long as required by Statute or for as long as Lawfulness of Processing can be established without consent.

WHAT IF YOU SELL THE PROPERTY?

Where the lessor is a Company, there is still an obligation on the Data Controller to maintain adequate accounting records and a list of past and present members.

However, if you sell the property only your name, address and transaction details are necessary to satisfy this requirement. All other contact details are erased.

WHAT ARE YOUR RIGHTS?

• You have a right to be informed

• You may request a copy of your data stored

• You may request correct to any erroneous data

• You may request deletion of data, if not in violation of statutory or contractual requirements

• You may request a restriction on processing

• You may lodge a complaint to the controller or object to processing

• You may lodge a complaint to the Supervisor Authority

• You may withdraw consent if processing originally required consent requirement. All other contact details are erased.

WHAT HAPPENS IN THE EVENT OF A DATA BREACH?

In the case of a data breach, the Data Controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the Supervisory Authority and Data Subject, if the personal data breach is likely to result in a risk to the rights and freedoms of natural persons.

WHERE CAN YOU FIND MORE INFORMATION?

A copy of your data and this statement is available by emailing our office at [email protected] and we will provide the information promptly.

Further information is available here:

• Companies Act 2006 http://www.legislation.gov.uk/ukpga/2006/46/notes/contents

• Official GDPR Website https://www.eugdpr.org/

• ICO https://ico.org.uk/

CHANGES TO THIS PRIVACY NOTICE

This Privacy Notice was published on 23rd October 2020 and last updated on 23rd October 2020. We may change this Privacy Notice from time to time, and when we do so the revision will be published on our website.